800-53|AC-6(2)

Title

NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS

Description

The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use non-privileged accounts or roles, when accessing nonsecurity functions.

Supplemental

This control enhancement limits exposure when operating from within privileged accounts or roles. The inclusion of roles addresses situations where organizations implement access control policies such as role-based access control and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.

Reference Item Details

Related: PL-4

Category: ACCESS CONTROL

Parent Title: LEAST PRIVILEGE

Family: ACCESS CONTROL

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.2 Ensure that the API server pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.2 Ensure that the API server pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.2 Ensure that the API server pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.3 Ensure that between two and four global admins are designatedmicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v1.4.0
1.1.3.17.1 Set 'User Account Control: Admin Approval Mode for the Built-in Administrator account' to 'Enabled'WindowsCIS Windows 8 L1 v1.0.0
1.1.4 Ensure that the controller manager pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.4 Ensure that the controller manager pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.4 Ensure that the controller manager pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.7 Set 'aaa accounting' to log all privileged use commands using 'commands 15'CiscoCIS Cisco IOS 15 L2 v4.1.1
1.1.8 Ensure that the etcd pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.8 Ensure that the etcd pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.8 Ensure that the etcd pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.10 Ensure that the Container Network Interface file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.10 Ensure that the Container Network Interface file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.10 Ensure that the Container Network Interface file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.14 Ensure that the admin.conf file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.14 Ensure that the admin.conf file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.14 Ensure that the admin.conf file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.16 Ensure that the scheduler.conf file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.16 Ensure that the scheduler.conf file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.16 Ensure that the scheduler.conf file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.18 Ensure that the controller-manager.conf file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.18 Ensure that the controller-manager.conf file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.18 Ensure that the controller-manager.conf file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.2.1 Set 'privilege 1' for local users - 'All users have encrypted passwords'CiscoCIS Cisco IOS 15 L1 v4.1.1
1.2.1 Set 'privilege 1' for local users - 'No users with privileges 2-15'CiscoCIS Cisco IOS 15 L1 v4.1.1
1.4 Ensure no 'root' user account access key exists - 'Access Key 1'amazon_awsCIS Amazon Web Services Foundations L1 1.4.0
1.4 Ensure no 'root' user account access key exists - 'Access Key 2'amazon_awsCIS Amazon Web Services Foundations L1 1.4.0
1.4.1 Set 'password' for 'enable secret'CiscoCIS Cisco IOS 17 L1 v1.0.0
1.4.1 Set 'password' for 'enable secret'CiscoCIS Cisco IOS 16 L1 v1.1.2
1.5 Ensure Interactive Login is DisabledWindowsCIS MySQL 5.6 Enterprise Windows OS L2 v2.0.0
1.5 Ensure Interactive Login is DisabledUnixCIS MySQL 5.6 Community Linux OS L2 v2.0.0
1.5 Ensure Interactive Login is DisabledUnixCIS MySQL 5.7 Enterprise Linux OS L2 v2.0.0
1.5 Ensure Interactive Login is DisabledWindowsCIS MySQL 5.6 Community Windows OS L2 v2.0.0
1.5 Ensure Interactive Login is DisabledUnixCIS MySQL 8.0 Enterprise Linux OS L2 v1.2.0
1.5 Ensure Interactive Login is DisabledWindowsCIS MySQL 5.7 Enterprise Windows OS L2 v2.0.0
1.5 Ensure Interactive Login is DisabledUnixCIS MySQL 5.6 Enterprise Linux OS L2 v2.0.0
1.5 Ensure Interactive Login is DisabledWindowsCIS MySQL 5.7 Community Windows OS L2 v2.0.0
1.5 Ensure Interactive Login is DisabledUnixCIS MySQL 5.7 Community Linux OS L2 v2.0.0
1.6 Ensure Administrative accounts are separate, unassigned, and cloud-onlymicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v1.4.0
1.7 Eliminate use of the 'root' user for administrative and daily tasksamazon_awsCIS Amazon Web Services Foundations L1 1.4.0
1.11 Do not setup access keys during initial user setup for all IAM users that have a console passwordamazon_awsCIS Amazon Web Services Foundations L1 1.4.0
1.21 Ensure that no custom subscription owner roles are created - Action Typesmicrosoft_azureCIS Microsoft Azure Foundations v1.3.1 L2
1.21 Ensure that no custom subscription owner roles are created - Assignable Scopemicrosoft_azureCIS Microsoft Azure Foundations v1.3.1 L2